CVE-2001-0060 — Use of Externally-Controlled Format String in Stunnel

5 documents5 sources
Severity
10.0CRITICALNVD
EPSS
1.1%
top 22.28%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Stunnel
Timeline
PublishedFeb 12
Latest updateApr 30

Description

Format string vulnerability in stunnel 3.8 and earlier allows attackers to execute arbitrary commands via a malformed ident username.

CVSS vector

AV:N/AC:L/C:C/I:C/A:CExploitability: 10.0 | Impact: 10.0

Affected Packages1 packages

▶NVDstunnel/stunnel4 versions+3

Patches

Patch: archives.neohapsis.com ↗Patch: www.securityfocus.com ↗Patch: www.securityfocus.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-cpcw-2gx9-xcwx: Format string vulnerability in stunnel 3↗2022-04-30
▶
CVEList
CVE-2001-0060: Format string vulnerability in stunnel 3↗2001-05-07
▶

📋Vendor Advisories

1
Red Hat
security flaw↗2000-12-18
▶

💬Community

1
Bugzilla
CVE-2001-0060 security flaw↗2018-08-16
▶
CVE-2001-0060 — Stunnel vulnerability | cvebase